Apache Geode Client/Server Authentication Vulnerability in Secure Mode

CVE-2017-9797

What is CVE-2017-9797?

In Apache Geode versions prior to v1.2.1, a severe vulnerability exists that allows an unauthenticated client to leverage multi-user authentication mode. This weakness could enable an attacker to send metadata messages that may disclose sensitive information about application data types. Furthermore, this vulnerability can lead to potential denial of service (DoS) attacks against the cluster, significantly compromising the integrity and availability of the service.

References